risepro | bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277

Analysis

max time kernel
291s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277.exe
Size

2.9MB
MD5

e65e164664ab397f268b5abd86370a25
SHA1

e0256d59c505898ce8eaba11c939643fa3608967
SHA256

bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277
SHA512

d31a1e248853b60c18b00879ea0a0033054ad655626074e171e0db19a511e3b0c3c0b06ca6d062577c25f77ea727313f69d1746795bee0f0b451e041474d162a
SSDEEP

49152:SJ6EhettSiTR62LBoWlSCyf+yBI+bIw8Twmo6dU1sTtUuZ+:cnO3lefc8b8T/o6diomuZ+

Score

10^/10

risepro evasion stealer

Malware Config

Extracted

Family

risepro

193.233.132.62

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine	bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2312	bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2312	bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277.exe

C:\Users\Admin\AppData\Local\Temp\bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277.exe
"C:\Users\Admin\AppData\Local\Temp\bc6cf59f8cbf0333e4d739bc4fac23864c66212e55a8d6d9728b065c56a65277.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-0-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-1-0x0000000077790000-0x0000000077792000-memory.dmp

Filesize
8KB

Download
memory/2312-2-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-4-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/2312-14-0x0000000002390000-0x0000000002392000-memory.dmp

Filesize
8KB

Download
memory/2312-13-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/2312-15-0x0000000002E90000-0x0000000002E92000-memory.dmp

Filesize
8KB

Download
memory/2312-12-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/2312-11-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2312-10-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/2312-9-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2312-8-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/2312-7-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/2312-6-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/2312-5-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/2312-3-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/2312-16-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-17-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-18-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-19-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-20-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-21-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-22-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-23-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-24-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-25-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-26-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-27-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-28-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-29-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-30-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-31-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-32-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-33-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-34-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-35-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-36-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-37-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-38-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-39-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-40-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-41-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-42-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-43-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-44-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-45-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download
memory/2312-46-0x00000000002C0000-0x0000000000859000-memory.dmp

Filesize
5.6MB

Download